ID

VAR-201201-0018

CVE

CVE-2011-3919

TITLE

libxml2 Heap-based buffer overflow vulnerability

DESCRIPTION

Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. libxml2 Contains a heap-based buffer overflow vulnerability.Service disruption by a third party (DoS) You may be put into a state or affected by other details. Google Chrome is prone to multiple vulnerabilities. Attackers can exploit these issues to execute arbitrary code in the context of the browser or cause denial-of-service conditions; other attacks may also be possible. Versions prior to Chrome 16.0.912.75 are vulnerable. It supports multiple encoding formats, XPath analysis, Well-formed and valid verification, etc. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201202-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: libxml2: User-assisted execution of arbitrary code Date: February 29, 2012 Bugs: #398361 ID: 201202-09 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A boundary error in libxml2 could result in execution of arbitrary code or Denial of Service. Background ========== libxml2 is the XML C parser and toolkit developed for the Gnome project. Workaround ========== There is no known workaround at this time. Resolution ========== All libxml2 users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/libxml2-2.7.8-r4" Packages which depend on this library may need to be recompiled. Tools such as revdep-rebuild may assist in identifying some of these packages. References ========== [ 1 ] CVE-2011-3919 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3919 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201202-09.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2012 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 APPLE-SA-2012-09-24-1 Apple TV 5.1 Apple TV 5.1 is now available and addresses the following: Apple TV Available for: Apple TV 2nd generation and later Impact: Viewing a maliciously crafted movie file may lead to an unexpected application termination or arbitrary code execution Description: An uninitialized memory access existed in the handling of Sorenson encoded movie files. This issue was addressed through improved memory initialization. CVE-ID CVE-2012-3722 : Will Dormann of the CERT/CC Apple TV Available for: Apple TV 2nd generation and later Impact: A malicious Wi-Fi network may be able to determine networks a device has previously accessed Description: Upon connecting to a Wi-Fi network, iOS may broadcast MAC addresses of previously accessed networks per the DNAv4 protocol. This issue was addressed by disabling DNAv4 on unencrypted Wi-Fi networks CVE-ID CVE-2012-3725 : Mark Wuergler of Immunity, Inc. Apple TV Available for: Apple TV 2nd generation and later Impact: Viewing a maliciously crafted TIFF file may lead to an unexpected application termination or arbitrary code execution Description: A buffer overflow existed in libtiff's handling of ThunderScan encoded TIFF images. This issue was addressed by updating libtiff to version 3.9.5. CVE-ID CVE-2011-1167 Apple TV Available for: Apple TV 2nd generation and later Impact: Viewing a maliciously crafted PNG image may lead to an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in libpng's handling of PNG images. These issues were addressed through improved validation of PNG images. CVE-ID CVE-2011-3026 : Juri Aedla CVE-2011-3048 CVE-2011-3328 Apple TV Available for: Apple TV 2nd generation and later Impact: Viewing a maliciously crafted JPEG image may lead to an unexpected application termination or arbitrary code execution Description: A double free issue existed in ImageIO's handling of JPEG images. This issue was addressed through improved memory management. CVE-ID CVE-2012-3726 : Phil of PKJE Consulting Apple TV Available for: Apple TV 2nd generation and later Impact: Viewing a maliciously crafted TIFF image may lead to an unexpected application termination or arbitrary code execution Description: An integer overflow issue existed in libTIFF's handling of TIFF images. This issue was addressed through improved validation of TIFF images. This issue does not affect OS X Mountain Lion systems. CVE-ID CVE-2012-1173 Apple TV Available for: Apple TV 2nd generation and later Impact: Applications that use ICU may be vulnerable to an unexpected application termination or arbitrary code execution Description: A stack buffer overflow existed in the handling of ICU locale IDs. This issue was addressed through improved bounds checking. CVE-ID CVE-2011-4599 Apple TV Available for: Apple TV 2nd generation and later Impact: An attacker with a privileged network position may cause an unexpected application termination or arbitrary code execution Description: Multiple vulnerabilities existed in libxml, the most serious of which may lead to an unexpected application termination or arbitrary code execution. These issues were addressed by applying the relevant upstream patches. CVE-ID CVE-2011-1944 : Chris Evans of Google Chrome Security Team CVE-2011-2821 : Yang Dingning of NCNIPC, Graduate University of Chinese Academy of Sciences CVE-2011-2834 : Yang Dingning of NCNIPC, Graduate University of Chinese Academy of Sciences CVE-2011-3919 : Juri Aedla Apple TV Available for: Apple TV 2nd generation and later Impact: An attacker with a privileged network position may cause an unexpected application termination or arbitrary code execution Description: Multiple memory corruption issues existed in JavaScriptCore. These issues were addressed through improved memory handling. CVE-ID CVE-2012-0682 : Apple Product Security CVE-2012-0683 : Dave Mandelin of Mozilla CVE-2012-3589 : Dave Mandelin of Mozilla CVE-2012-3590 : Apple Product Security CVE-2012-3591 : Apple Product Security CVE-2012-3592 : Apple Product Security CVE-2012-3678 : Apple Product Security CVE-2012-3679 : Chris Leary of Mozilla Installation note: Apple TV will periodically check for software updates. Alternatively, you may manually check for software updates by selecting "Settings -> General -> Update Software". To check the current version of software, select "Settings -> General -> About". One of those standards is the XML Path Language (XPath), which is a language for addressing parts of an XML document. (CVE-2011-2834) Note: Red Hat does not ship any applications that use libxml2 in a way that would allow the CVE-2011-2834 flaw to be exploited; however, third-party applications may allow XPath expressions to be passed which could trigger this flaw. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . Relevant releases ESX 5.0 without patch ESXi500-201207101-SG 3. Problem Description a. ESXi update to third party component libxml2 The libxml2 third party library has been updated which addresses multiple security issues The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-4008, CVE-2010-4494, CVE-2011-0216, CVE-2011-1944, CVE-2011-2821, CVE-2011-2834, CVE-2011-3905, CVE-2011-3919 and CVE-2012-0841 to these issues. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product Running Replace with/ Product Version on Apply Patch ========== ======== ======== ================= vCenter any Windows not affected hosted * any any not affected ESXi 5.0 any ESXi500-201207101-SG ESXi 4.1 any patch pending ESXi 4.0 any patch pending ESXi 3.5 any patch pending ESX any any not applicable * hosted products are VMware Workstation, Player, ACE, Fusion. Note: "patch pending" means that the product is affected, but no patch is currently available. The advisory will be updated when a patch is available. Solution Please review the patch/release notes for your product and version and verify the checksum of your downloaded file. ESXi 5.0 -------- ESXi500-201207001 md5sum: 01196c5c1635756ff177c262cb69a848 sha1sum: 85936f5439100cd5fb55c7add574b5b3b937fe86 http://kb.vmware.com/kb/2020571 ESXi500-201207001 contains ESXi500-201207101-SG 5. Change log 2012-07-12 VMSA-2012-0012 Initial security advisory in conjunction with the release of a patch for ESXi 5.0 on 2012-07-12. Contact E-mail list for product security notifications and announcements: http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce This Security Advisory is posted to the following lists: * security-announce at lists.vmware.com * bugtraq at securityfocus.com * full-disclosure at lists.grok.org.uk E-mail: security at vmware.com PGP key at: http://kb.vmware.com/kb/1055 VMware Security Advisories http://www.vmware.com/security/advisories VMware security response policy http://www.vmware.com/support/policies/security_response.html General support life cycle policy http://www.vmware.com/support/policies/eos.html VMware Infrastructure support life cycle policy http://www.vmware.com/support/policies/eos_vi.html Copyright 2012 VMware Inc. All rights reserved. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: libxml2 security update Advisory ID: RHSA-2012:0018-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2012-0018.html Issue date: 2012-01-11 CVE Names: CVE-2011-3905 CVE-2011-3919 ===================================================================== 1. Summary: Updated libxml2 packages that fix two security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node (v. 6) - x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: The libxml2 library is a development toolbox providing the implementation of various XML standards. A remote attacker could provide a specially-crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2011-3919) An out-of-bounds memory read flaw was found in libxml2. A remote attacker could provide a specially-crafted XML file that, when opened in an application linked against libxml2, would cause the application to crash. (CVE-2011-3905) All users of libxml2 are advised to upgrade to these updated packages, which contain backported patches to correct these issues. The desktop must be restarted (log out, then log back in) for this update to take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/libxml2-2.7.6-4.el6_2.1.src.rpm i386: libxml2-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-python-2.7.6-4.el6_2.1.i686.rpm x86_64: libxml2-2.7.6-4.el6_2.1.i686.rpm libxml2-2.7.6-4.el6_2.1.x86_64.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.x86_64.rpm libxml2-python-2.7.6-4.el6_2.1.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/libxml2-2.7.6-4.el6_2.1.src.rpm i386: libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-devel-2.7.6-4.el6_2.1.i686.rpm libxml2-static-2.7.6-4.el6_2.1.i686.rpm x86_64: libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.x86_64.rpm libxml2-devel-2.7.6-4.el6_2.1.i686.rpm libxml2-devel-2.7.6-4.el6_2.1.x86_64.rpm libxml2-static-2.7.6-4.el6_2.1.x86_64.rpm Red Hat Enterprise Linux HPC Node (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/libxml2-2.7.6-4.el6_2.1.src.rpm x86_64: libxml2-2.7.6-4.el6_2.1.i686.rpm libxml2-2.7.6-4.el6_2.1.x86_64.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.x86_64.rpm libxml2-python-2.7.6-4.el6_2.1.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/libxml2-2.7.6-4.el6_2.1.src.rpm x86_64: libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.x86_64.rpm libxml2-devel-2.7.6-4.el6_2.1.i686.rpm libxml2-devel-2.7.6-4.el6_2.1.x86_64.rpm libxml2-static-2.7.6-4.el6_2.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/libxml2-2.7.6-4.el6_2.1.src.rpm i386: libxml2-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-devel-2.7.6-4.el6_2.1.i686.rpm libxml2-python-2.7.6-4.el6_2.1.i686.rpm ppc64: libxml2-2.7.6-4.el6_2.1.ppc.rpm libxml2-2.7.6-4.el6_2.1.ppc64.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.ppc.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.ppc64.rpm libxml2-devel-2.7.6-4.el6_2.1.ppc.rpm libxml2-devel-2.7.6-4.el6_2.1.ppc64.rpm libxml2-python-2.7.6-4.el6_2.1.ppc64.rpm s390x: libxml2-2.7.6-4.el6_2.1.s390.rpm libxml2-2.7.6-4.el6_2.1.s390x.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.s390.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.s390x.rpm libxml2-devel-2.7.6-4.el6_2.1.s390.rpm libxml2-devel-2.7.6-4.el6_2.1.s390x.rpm libxml2-python-2.7.6-4.el6_2.1.s390x.rpm x86_64: libxml2-2.7.6-4.el6_2.1.i686.rpm libxml2-2.7.6-4.el6_2.1.x86_64.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.x86_64.rpm libxml2-devel-2.7.6-4.el6_2.1.i686.rpm libxml2-devel-2.7.6-4.el6_2.1.x86_64.rpm libxml2-python-2.7.6-4.el6_2.1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/libxml2-2.7.6-4.el6_2.1.src.rpm i386: libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-static-2.7.6-4.el6_2.1.i686.rpm ppc64: libxml2-debuginfo-2.7.6-4.el6_2.1.ppc64.rpm libxml2-static-2.7.6-4.el6_2.1.ppc64.rpm s390x: libxml2-debuginfo-2.7.6-4.el6_2.1.s390x.rpm libxml2-static-2.7.6-4.el6_2.1.s390x.rpm x86_64: libxml2-debuginfo-2.7.6-4.el6_2.1.x86_64.rpm libxml2-static-2.7.6-4.el6_2.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/libxml2-2.7.6-4.el6_2.1.src.rpm i386: libxml2-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-devel-2.7.6-4.el6_2.1.i686.rpm libxml2-python-2.7.6-4.el6_2.1.i686.rpm x86_64: libxml2-2.7.6-4.el6_2.1.i686.rpm libxml2-2.7.6-4.el6_2.1.x86_64.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-debuginfo-2.7.6-4.el6_2.1.x86_64.rpm libxml2-devel-2.7.6-4.el6_2.1.i686.rpm libxml2-devel-2.7.6-4.el6_2.1.x86_64.rpm libxml2-python-2.7.6-4.el6_2.1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/libxml2-2.7.6-4.el6_2.1.src.rpm i386: libxml2-debuginfo-2.7.6-4.el6_2.1.i686.rpm libxml2-static-2.7.6-4.el6_2.1.i686.rpm x86_64: libxml2-debuginfo-2.7.6-4.el6_2.1.x86_64.rpm libxml2-static-2.7.6-4.el6_2.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2011-3905.html https://www.redhat.com/security/data/cve/CVE-2011-3919.html https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2012 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFPDc9aXlSAg2UNWIIRAvBLAJ9XWU2IwjWK3hRYku0jl8sWdhlv3wCgizaq rcfEVWjyoSYVbcwQm9MgQwM= =AIBd -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce

AFFECTED PRODUCTS